Metabase Pre-Auth H2 JDBC RCE
- Product
- Metabase Metabase
- CVE
- CVE-2023-38646
- Disclosed
- 2023-07-21
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- Metabase OSS < 0.46.6.1 and Enterprise < 1.46.6.1 (plus older branches)
- Fixed
- 0.46.6.1 / 1.46.6.1; also 0.45.4.1, 0.44.7.1, 0.43.7.2 and Enterprise equivalents
Summary
A leftover setup token let unauthenticated users reach Metabase's database-connection validation endpoint. Assetnote chained this with an H2 JDBC connection string to execute code on the server.
Root cause
After a 2022 change, the one-time setup-token was no longer cleared after installation and was exposed via /api/session/properties. /api/setup/validate, which accepts that token without login, tests arbitrary database connection details; an H2 JDBC URL with INIT/TRIGGER clauses runs attacker-supplied SQL that compiles and executes Java/JavaScript.
Impact
Unauthenticated remote code execution on the Metabase server.
Detection
Check whether /api/session/properties returns a non-null setup-token; look for POST /api/setup/validate with H2 connection strings. Nuclei template CVE-2023-38646 exists.
Mitigation
Upgrade to a patched release and block /api/setup/* at the reverse proxy.